CVE-2026-126770: OpsTree REMS through 1.0.0 SSRF via Database Test Connection
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with access to create or modify a database entry and invoke its Test Connection feature can exploit it. The request originates from the REMS backend, so reachable internal services may be exposed even if they are not directly accessible to that user.
What can an attacker do with the Test Connection feature?
They can set the database host and port to localhost, internal IP addresses, or attacker-controlled servers. This can be used to probe hosts and ports that the REMS server can reach.
How can I assess whether my deployment is exposed?
Check whether your REMS version is through 1.0.0 and whether authenticated users can configure database connection host and port values and run Test Connection. Review database-entry settings and relevant backend connection logs for test requests targeting localhost, internal addresses, or unexpected external destinations.